[CONFIG]: Add typed environment validation and strict client/server secret boundaries

[barry01-hash]

Context

Runtime configuration is read directly across server and client modules with non-null assertions, empty-string fallbacks, and NEXT_PUBLIC_* variables. Misconfiguration may only surface during a user operation, and privileged values can accidentally cross the client bundle boundary.

Scope

• Define separate server-only and client-safe environment schemas with Zod or equivalent.
• Validate URLs, network IDs, fees, contract addresses, email configuration, and required production values at startup/build time.
• Expose client configuration through a minimal typed module containing only intentionally public values.
• Add build-time checks that server-only modules/variables are never imported into client components.
• Document local, preview, staging, and production configuration matrices.
• Add safe key rotation guidance and ensure diagnostic output never prints values.

Acceptance criteria

• Missing or malformed required configuration fails fast with variable names but no secret values.
• No privileged credential is named or bundled as client-public configuration.
• Tests cover each environment mode and conditional requirement.
• CI scans built artifacts/source maps for forbidden server variable names.
• .env.example is complete, categorized, and uses non-sensitive placeholders.
• Network/contract mismatches are rejected before escrow operations are enabled.

Relevant areas

.env.example, src/lib/*, build-escrow.utils.ts, providers, file routes, next.config.ts.